3 ms·
From my banks web site? Effectively zero. Nothing will happen unless you validate the transactions using two factor authentication (user id + code app/single us
by doikor 8y ago
From my banks web site? Effectively zero. Nothing will happen unless you validate the transactions using two factor authentication (user id + code app/single use paper code)
(In my experience all bank web sites work like above here in Finland)
- slig 8y agoOne possible attack is to change the details of a transaction before the page post it. To the user it would appear as she's transferring money to Bob, but it'd go to Eve.
- magicalhippo 8y agoMy bank has two-factor using some special applet thingy on my phone (not a regular app, it's tied into the SIM card somehow). It shows me the details (amount and destination account) which I have to confirm using my password (in combination with a key from the SIM). Much more difficult to circumvent, assuming the user pays attention...
- chii 8y agoThen, the malicious script can just pop up an official looking dialog box with a message saying that they are 'testing' the confirmation system, and please accept/agree to the next sms/alert from the app. Having direct control of the user interface is very powerful.
- magicalhippo 8y agoOf course one has to have a minimum of awareness for any protection mechanism to work.
- moviuro 8y agoEve should be among the known receivers though, which is a world of slow (~72hours to add an IBAN to my list for instance). There are banks that try to make it faster though, with MFA, though the MFA system is usually SMS.
- JeremyBanks 8y agoThe banks I've used in Canada allow you to send transfers (uip to $3000) to other domestic bank accounts without reautenticating. Fortunately, they don't seem to use any third-party JavaScript.